For those who were slightly confused as to why this post talks about 4.3 when 4.8 is a few days away from release - if you miss it at the end, Kees is just catching up and will do more posts covering 4.4 to 4.8 :)
Ambient capabilities seems to finally make capabilities usable!
Yes, and together with systemd it makes it super trivial to run stuff on things like privileged ports or sending ICMP and stuff like that. Great stuff!
Do you have any video/audio of the talk?
He gave two talks, the one he referenced in the article, "The State of Kernel Self Protection Project", is here: